schnorr signatures – Ought to a good Y coordinate be enforced after each key-tweak operation, or solely on the finish?

It is a very area of interest query concerning BIP340 and key tweaking with even-only public keys.

I really feel my query could also be a matter of opinion, since there would not seem like an accepted proper / mistaken approach to do issues.

Key Tweaking

For instance that you simply wish to apply a sequence of tweaks to a secret key, and the returned key must have a good Y coordinate.

You have got two operations accessible:

• [tweak] secret key (sec * tweak % N)
• [negate?] secret key (if pub(sec) == odd then sec * (N – 1))

You’ll be able to apply the tweaks in two doable methods:

• 1. [tweak], [tweak], [negate?]
• 2. [tweak], [negate?], [tweak], [negate]

Each options are legitimate, and can produce the specified key. Nevertheless, neither answer is suitable with the opposite, so all events should agree on which methodology to make use of.

So what’s the accepted answer right here? The primary answer requires much less operations, however the second answer can also have some profit?

The idea of even-only public keys is comparatively new, so I am undecided what the clear consensus is right here.

Any suggestions can be enormously appreciated!